Debian Linux Security Advisory 5629-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.
fe6f1b5481a47f52acca8337fa69156b933a7a36fb449ecf930207ee4aae57f8
Backdoor.Win32.Armageddon.r malware suffers from a hardcoded credential vulnerability.
a63aee2a17b2de0fd0b66bd203d4a2c97938d4d3f44312228c88c11909ae9131
Debian Linux Security Advisory 5628-1 - handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed image files are processed.
f3cb8b62b33597d095e3b6b6dd3d138b869540fe77fdd212e1777a113e936759
This Metasploit module exploits an authentication bypass vulnerability that allows an unauthenticated attacker to create a new administrator user account on a vulnerable ConnectWise ScreenConnect server. The attacker can leverage this to achieve remote code execution by uploading a malicious extension module. All versions of ScreenConnect version 23.9.7 and below are affected.
5465f1cab9f564966ac69e4c23f983ee109116e8a263d414680ea78f05ecbd2a
SuperCali version 1.1.0 suffers from a cross site scripting vulnerability.
9f0cd74fe8260d16546ba65db15a5a931753546b0b6b4a4d0d6641c9eee1e37a
Red Hat Security Advisory 2024-0952-03 - An update for firefox is now available for Red Hat Enterprise Linux 9. Issues addressed include a spoofing vulnerability.
36e71a6e7e57cf604ec327de0e6930e7149f97eee59eecefda9291402bcab7a7
Red Hat Security Advisory 2024-0951-03 - An update for postgresql is now available for Red Hat Enterprise Linux 9.
214553eadea691b45f4cbb9f31d8593002013312ec8243315ad28d3e92541add
Red Hat Security Advisory 2024-0950-03 - An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 9.
751c0b3a79fa95ee4e593a740c35d88621d85750cdb0a007d5c2baa9115539cc
In this paper, the authors show that the design of DNSSEC is flawed. Exploiting vulnerable recommendations in the DNSSEC standards, they developed a new class of DNSSEC-based algorithmic complexity attacks on DNS, they dubbed KeyTrap attacks. All popular DNS implementations and services are vulnerable. With just a single DNS packet, the KeyTrap attacks lead to a 2.000.000x spike in CPU instruction count in vulnerable DNS resolvers, stalling some for as long as 16 hours. This devastating effect prompted major DNS vendors to refer to KeyTrap as "the worst attack on DNS ever discovered". Exploiting KeyTrap, an attacker could effectively disable Internet access in any system utilizing a DNSSEC-validating resolver.
4c1743e665520f276be83b47e7a1ae86496ca84f1935e9197aa5b5736fc57eb4
Debian Linux Security Advisory 5627-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.
fecc020dcddb2184341c57558aa3f486e8ee301dd59c165be89472e03edd082b
Gentoo Linux Security Advisory 202402-29 - Multiple vulnerabilities have been found in LibreOffice, the worst of which could result in user-assisted code execution. Versions greater than or equal to 7.5.9.2 are affected.
dd6e66d7eafddfab7d5156af7a48ea9c2e0fe469f1184c2f3d3a13a501c9039a
There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage (NAS) devices, and QuTS hero is a core part of the firmware for numerous QNAP high-end and enterprise NAS devices. The vulnerable endpoint is the quick.cgi component, exposed by the device's web based administration feature. The quick.cgi component is present in an uninitialized QNAP NAS device. This component is intended to be used during either manual or cloud based provisioning of a QNAP NAS device. Once a device has been successfully initialized, the quick.cgi component is disabled on the system. An attacker with network access to an uninitialized QNAP NAS device may perform unauthenticated command injection, allowing the attacker to execute arbitrary commands on the device.
512c538bc485b9095fb0fb14daba0e91a985496262d3017dc3aaf05f8005e9ad
Ubuntu Security Notice 6649-1 - Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Alfred Peters discovered that Firefox did not properly manage memory when storing and re-accessing data on a networking channel. An attacker could potentially exploit this issue to cause a denial of service.
915d1dd9c871ef5fa18727920f32a507f24302608c703c4e810bc2c237c6b315
CMS Made Simple version 2.2.19 suffers from a server-side template injection vulnerability.
678bb66608e7b41c5cd05528ea7219cf35638614441463568f81ba0d9dab3df4
CMS Made Simple version 2.2.19 suffers from a persistent cross site scripting vulnerability.
aaabe1d02e7411b3fdb5bd9220f8bd34a7c9e15203321299cabd15dca9372cde
Ubuntu Security Notice 6648-1 - It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service.
74220a0b0c8b546e1843028c546fb7b9f332ab5279db8baa8ddaf07d3915746e
CMS Made Simple versions 2.2.19 and 2.2.21 suffer from a remote code execution vulnerability.
1fba8dc39f6eab628cec63c1efe79d88f846728e2cc5c0253884d3ade1777638
SitePad version 1.8.2 suffers from a persistent cross site scripting vulnerability.
48e6c1331a13411ebde677abf495089e3693574074e2831d427d7943a6dded2a
Dotclear version 2.29 suffers from a cross site scripting vulnerability.
48697a04e731c5ea3f3bb5bbf9027809e1f2b25c54b903adb00f897d6247d1e6
Red Hat Security Advisory 2024-0937-03 - An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include a privilege escalation vulnerability.
53876467f9ebca4e456042e6c4c0da9077be705693c4f66d286ed5227191e05f
Red Hat Security Advisory 2024-0934-03 - An update is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, and Red Hat Virtualization Engine 4.4. Issues addressed include a bypass vulnerability.
82f813d2c5260af55329640b24210beacb0a418fd53acfeabcd781b5a646c380
Red Hat Security Advisory 2024-0853-03 - Network Observability is an OpenShift operator that deploys a monitoring pipeline to collect and enrich network flows that are produced by the Network Observability eBPF agent.
83d3e13a79ac7d00bf72ee5d0fcb0eaea63e6e35d0ed933647b0c96a58562b38
FreeIPA version 4.10.1 has an issue where specially crafted HTTP requests potentially lead to denial of service or data exposure.
ed1964cddf58cd1a3b007267cb1f6a3b11008a5d76ebdb87f9a639382cd73688
Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference. This is the current 3.x.x release.
368f11f426f1205aedb9e9e32368a16535dc11bd60351066e6f6664ec36b85b9
Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference. This is the current 2.19.x release.
5a3a88ef6433e97bcab0efa1ed60c6197e4ada9d9d30bc1c47437bf89b97f276